Backup and Recovery vulnerabilities

7 known vulnerabilities in Backup and Recovery from Veeam. 7 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  Backup and Recovery: Improper Neutralization of Special Elements used in a Command

  CVE-2025-59470Jan 8, 2026VeeamEPSS 1.53%

  This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

• 9.1 Critical severity

  Backup and Recovery: Improper Neutralization of Special Elements used in a Command

  CVE-2025-59468Jan 8, 2026VeeamEPSS 1.18%

  This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

• 8.3 High severity

  Backup and Recovery: Improper Certificate Validation

  CVE-2024-40714Sep 7, 2024Veeam

  An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.

• 7.8 High severity

  Backup and Recovery: Improper Authentication

  CVE-2024-40713Sep 7, 2024Veeam

  A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.

• 7.8 High severity

  Backup and Recovery: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-40712Sep 7, 2024Veeam

  A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).

• 9.8 Critical severity

  Veeam Backup and Replication Deserialization Exploited

  CVE-2024-40711Sep 7, 2024VeeamEPSS 90.4%

  A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

• 8.8 High severity

  Backup and Recovery: Insufficiently Protected Credentials

  CVE-2024-40710Sep 7, 2024VeeamEPSS 1.12%

  A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has b